Fastjson反序列化漏洞原理分析及复现

Fastjson序列化与反序列化

常规反序列化

Fastjson的序列化与反序列化与常规的java反序列化不同，我们先来看一下正常的java反序列化，使用下面一段代码：

package com.armandhe.javabase;

import java.io.*;

public class Unserialize {
   
    public static void main(String[] args) {
   
        File file = new File("Unserilize.txt");
        try {
   

            //新建一个对象
            UnserializeTest unserializeTest = new UnserializeTest();
            unserializeTest.name = "armandhe";

            //序列化
            FileOutputStream fileOutputStream = new FileOutputStream(file);
            ObjectOutputStream outputStream = new ObjectOutputStream(fileOutputStream);
            outputStream.writeObject(unserializeTest);
            outputStream.close();
//            fileOutputStream.close();

            //反序列化
            FileInputStream fileInputStream = new FileInputStream(file);
            ObjectInputStream objectInputStream = new ObjectInputStream(fileInputStream);
            try {
   
                UnserializeTest o = (UnserializeTest) objectInputStream.readObject();
                System.out.println(o.name);
            } catch (ClassNotFoundException e) {
   
                e.printStackTrace();
            }

        } catch (IOException e) {
   
            e.printStackTrace();
        }
    }
}

class UnserializeTest implements Serializable{
   
    public String name;
    private void readObject(ObjectInputStream in) throws IOException,ClassNotFoundException{
   
        in.defaultReadObject();
        System.out.println("执行了readObject函数！！");
        Runtime.getRuntime().exec("calc.exe");